January 2022 - slf4j-dev - mailman3.qos.ch

[JIRA] Updates for SLF4J-537: Release slf4j-jdk-platform-logging for 1.x
by QOS.CH (JIRA) 17 Jan '22

17 Jan '22

SLF4J / SLF4J-537 [Open] Release slf4j-jdk-platform-logging for 1.x ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-537 ============================== Issue created ------------------------------ Ben Manes created this issue on 17/Jan/22 6:48 PM Summary: Release slf4j-jdk-platform-logging for 1.x Issue Type: Improvement Assignee: SLF4J developers list Created: 17/Jan/22 6:48 PM Priority: Major Reporter: Ben Manes Description: Support for the Java 9 platform logger could be added without negatively impacting slf4j 1.x. Those users who are on later JDKs can opt-in and benefit due to being an independent dependency. Currently only 2.x has support, but it is in alpha so most users will not benefit. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-536: Add keyed deque support to MDC
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-536 [Open] Add keyed deque support to MDC ============================== Here's what changed in this issue in the last few minutes. This issue has been created View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-536 ============================== Issue created ------------------------------ Ceki Gülcü created this issue on 14/Jan/22 12:11 AM Summary: Add keyed deque support to MDC Issue Type: Bug Assignee: Ceki Gülcü Components: Core API Created: 14/Jan/22 12:11 AM Environment: Keyed deque in MDC can be quite useful and should be property documented. Priority: Major Reporter: Ceki Gülcü ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 9:54 PM [~Neustradamus] Good suggestion. Will do and thank you. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-431: Mark EventData as deprecated in preparation for its removal
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-431 [Closed] Mark EventData as deprecated in preparation for its removal ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-431 ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 9:42 PM In 1.8.0-beta2 we are talking about the deprecation of the {{EventData}} class. Thus, the 1.8.0-beta2 tag for fix version is correct and does not need to be changed. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-430: Remove org.slf4j.ext.EventData due to security issue
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-430 [Reopened] Remove org.slf4j.ext.EventData due to security issue ============================== Here's what changed in this issue in the last few minutes. There are 2 updates, 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-430 ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 13/Jan/22 9:35 PM Resolution: (was: Fixed) Status: Reopened (was: Closed) ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 9:37 PM Changed the fixed tag to version 1.8.0-beta4. There was no 1.8.0-beta3 release. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 1 comment ------------------------------ Neustradamus on 13/Jan/22 9:23 PM @ceki: Update Issue 430 and 431 with the good solved versions. Inform about the organization which manages CVEs to update the CVE-2018-8088: It has been solved in 1.7.26 and 1.8.0-beta4. You can inform too for: - Fix CVE-2021-4104 - Fix CVE-2019-17571 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-431: Mark EventData as deprecated in preparation for its removal
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-431 [Closed] Mark EventData as deprecated in preparation for its removal ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-431 ============================== 1 comment ------------------------------ Neustradamus on 13/Jan/22 9:15 PM It has not been solved in 1.8.0-beta3 (no release), it has been solved in 1.8.0-beta4 and 1.7.26 (stable). Linked to: - https://jira.qos.ch/browse/SLF4J-455 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There are 2 comments. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 2 comments ------------------------------ Neustradamus on 13/Jan/22 9:09 PM @ceki: I know that 1.8-beta is now 2.0-alpha. CVE-2018-8088 has been fixed in 1.7.26 and 1.8.0-beta4 after my requests by e-mail, JIRA, and Twitter. But in the CVE-2018-8088 it is noted solved in 1.8.0-beta2 but it is NOT TRUE IT IS IN 1.8.0-beta4 and it has been solved in stable branch in 1.7.26, it is not specified: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8088 - https://www.google.com/search?q=CVE-2018-8088 There is a problem in description of the CVE-2018-8088: ``` org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. ``` Time to request the update with reality the JIRA ticket number 455 and the CVE: - 1.8.0-beta4 - 1.7.26 JIRA: - https://jira.qos.ch/browse/SLF4J-455 - http://mailman.qos.ch/pipermail/slf4j-dev/2019-February/005118.html Your tickets about CVE but it has been solved in 1.8.0-beta4: https://www.slf4j.org/news.html There was not a 1.8.0-beta3! - Currently it is specified 1.8.0-beta3: https://jira.qos.ch/browse/SLF4J-430 - Currently it is specified 1.8.0-beta2: https://jira.qos.ch/browse/SLF4J-431 Mail: - http://mailman.qos.ch/pipermail/slf4j-user/2019-February/001700.html - http://mailman.qos.ch/pipermail/slf4j-dev/2019-February/005115.html Twitter: - https://twitter.com/neustradamus/status/1095041579780374529 - https://twitter.com/neustradamus/status/1098724924607393794 - https://twitter.com/neustradamus/status/1098725012494635008 - https://twitter.com/neustradamus/status/1411324627582963722 ------------------------------ Ceki Gülcü on 13/Jan/22 9:12 PM The issue has been solved in all live branches. What do you want to be done at this time? ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-430: Remove org.slf4j.ext.EventData due to security issue
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-430 [Closed] Remove org.slf4j.ext.EventData due to security issue ============================== Here's what changed in this issue in the last few minutes. There are 2 comments. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-430 ============================== 2 comments ------------------------------ Neustradamus on 13/Jan/22 9:12 PM It has been solved in 1.8.0-beta4, there was not 1.8.0-beta4 and 1.7.26 (stable). Linked to: - https://jira.qos.ch/browse/SLF4J-455 ------------------------------ Neustradamus on 13/Jan/22 9:15 PM Sorry, the good text is: It has not been solved in 1.8.0-beta3 (no release), it has been solved in 1.8.0-beta4 and 1.7.26 (stable). Linked to: - https://jira.qos.ch/browse/SLF4J-455 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There are 2 updates, 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 13/Jan/22 7:24 PM Resolution: Fixed Status: Resolved (was: Open) ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 7:23 PM 2.0.0 has all the changes from 1.8.x. Thus, CVE-2018-8088 has been fixed both in the 2.0.0 and 1.7.x branches. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0